microsoft / microsoft/krabsetw

Add ability for krabsetw trace sessions to be updated while running

Open
#36 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature request
Dominant language
C++
Stars
801
Forks
167
Avg merge
3d 15m
Merged PRs (30d)
2

Description

A user has requested that krabsetw support modifying trace options while the trace is running. This would require updates to the API surface for user-mode and kernel-mode traces.

The Win32 APIs to use for this are distinct for kernel-mode vs user-mode trace sessions:

  • kernel-mode: ControlTrace using the EVENT_TRACE_CONTROL_UPDATE value for the ControlCode argument
  • user-mode: EnableTraceEx2 using the EVENT_CONTROL_CODE_DISABLE_PROVIDER value for the ControlCode argument

Ideally, updates to the krabsetw APIs will keep track of the current state of settings before they're changed. This isn't a hard requirement but it would reduce some burden on API users.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by mapping the krabsetw API surface for user-mode and kernel-mode trace sessions, then read the referenced Win32 APIs: ControlTrace with EVENT_TRACE_CONTROL_UPDATE and EnableTraceEx2 with EVENT_CONTROL_CODE_DISABLE_PROVIDER. Done means running sessions can accept updated trace options through both APIs, with current settings retained where practical.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
observability-sre, operating-systems
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.